feat: add wallet authentication and permissions

.env.example

@@ -1,6 +1,5 @@
-# Public wallet/app configuration
+# Public app configuration
 NEXT_PUBLIC_APP_URL=http://localhost:3000
-NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID=
 
 # Server-only configuration
 DATABASE_URL=
@@ -12,6 +11,10 @@ ENCRYPTION_KEY=
 GNOSIS_RPC_URL=
 MAIN_SAFE_ADDRESS=
 DAO_CONTRACT_ADDRESS=
+DAO_SHARE_TOKEN_ADDRESS=
+DAO_SHARE_THRESHOLD=100
+HATS_CONTRACT_ADDRESS=
+# Decimal or hex Hat ID values are both accepted.
 ANGRY_DWARF_HAT_ID=
 
 # External APIs

README.md

@@ -53,15 +53,25 @@ The repo is public. Do not commit real treasury addresses, DAO addresses, RPC UR
 
 Use `.env.local` for local secrets. `.env.example` should contain only placeholder keys.
 Drizzle CLI commands also load `.env`, with `.env.local` overriding it when present.
-The app targets Neon in production, while Drizzle migrations use the standard `pg` driver so local Postgres databases work with `pnpm db:migrate`.
+The app targets Neon in production. At runtime it uses Neon HTTP for Neon URLs and the standard `pg` driver for localhost database URLs, so local Postgres works in both the app and migrations.
 `pnpm db:reset:local` refuses non-localhost database URLs and protected database names, but it is still destructive for the selected local database.
 
+RaidGuild member access is checked with `DAO_SHARE_TOKEN_ADDRESS`, the DAOhaus/Baal ERC-20 shares token. `DAO_SHARE_THRESHOLD` is written as a human share amount such as `100`.
+`HATS_CONTRACT_ADDRESS` is the Hats Protocol contract address used for hats-based permissions, formatted as a `0x`-prefixed EVM address. Use the deployed Hats contract for the target network, or a local test contract address for local chain testing.
+`ANGRY_DWARF_HAT_ID` can be provided as a decimal or hex string and requires `HATS_CONTRACT_ADDRESS` to function.
+
 `ENCRYPTION_KEY` must be a base64-encoded 32-byte key. Multiple-key rotation requires stable `key-id:base64-key` entries. To generate a local development key:
 
 ```bash
 openssl rand -base64 32
 ```
 
+`SESSION_SECRET` must be at least 32 characters. To generate a local development value:
+
+```bash
+openssl rand -base64 32
+```
+
 ## Database Deployment
 
 The `Database` GitHub Actions workflow checks generated migrations on pull requests and applies committed migrations on pushes to `main`.

package.json

@@ -19,18 +19,23 @@
   "dependencies": {
     "@base-ui/react": "^1.5.0",
     "@neondatabase/serverless": "^1.1.0",
+    "@tanstack/react-query": "^5.100.14",
     "@vercel/analytics": "^2.0.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "drizzle-orm": "^0.45.2",
+    "iron-session": "^8.0.4",
     "lucide-react": "^1.17.0",
     "next": "16.2.6",
     "pg": "^8.18.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "server-only": "^0.0.1",
+    "siwe": "^3.0.0",
     "tailwind-merge": "^3.6.0",
-    "tw-animate-css": "^1.4.0"
+    "tw-animate-css": "^1.4.0",
+    "viem": "^2.51.3",
+    "wagmi": "^3.6.16"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",